5 ms·

Can someone explain why my browser provides referer info at all? Why isn't this a permission I need to give away? What common features that the user needs on

Can someone explain why my browser provides referer info at all? Why isn't this a permission I need to give away? What common features that the user needs on the web rely on it?

DanBC 10y ago
The RFC suggested that permissions should be asked for. https://tools.ietf.org/html/rfc1945#section-10.13 https://tools.ietf.org/html/rfc1945#section-10.13 Note: Because the source of a link may be private information or may reveal an otherwise private information source, it is strongly recommended that the user be able to select whether or not the Referer field is sent. For example, a browser client could have a toggle switch for browsing openly/anonymously, which would respectively enable/disable the sending of Referer and From information.
- nothrabannosir 10y ago
  Not that it should be asked for; just that it should be configurable. Subtle but important difference. Firefox is following this recommendation, but doesn't ask for it explicitly.
detaro 10y ago
It's one of these things that were added once, pages started to rely on it and now nobody wants to turn it off globally because things will break. They've added ways for sites to control if/how much information is sent on outgoing links though in recent browsers. e.g. in HN's HTML you find <meta name="referrer" content="origin"> which tells the browser to only send the domain, but not the exact URL.
pierrec 10y ago
>What common features that the user needs on the web rely on it? - Website owners and content creators use the Referer to see where their users are coming from, which allows them to make content which is more suitable, which indirectly benefits the user. - It helps prevent hotlinking, so it can protect small websites from getting hammered, which again could indirectly benefit the user. I guess the point is that everyone's a "user" of HTTP, including website owners, and their interests are partly linked to yours. In an objective sense I find the standard still makes sense. In an individualistic sense, things are more complicated.
chestnut-tree 10y ago
If you are using Firefox, you can disable referrer info without using a plugin. Here‘s how: In the URL bar, type the following and press enter: about:config Now search for the following entry on the page: network.http.sendRefererHeader The default value is 2. Change this to 0. This disables the referrer header. Note that some sites won‘t allow you to sign in or register if the referrer header is disabled (e.g. Pinterest), so you may have to temporarily enable the referrer header in those instances. A final point is that this Firefox setting obviously has no effect if referral info is already appended to the URL (as is the case with Google search results).
- userbinator 10y ago
  There's also an intermediate value of 1, which AFAICS disables referer sending on requests for embedded images: http://kb.mozillazine.org/Network.http.sendRefererHeader http://kb.mozillazine.org/Network.http.sendRefererHeader
- LukeShu 10y ago
  Alternatively, you can instead set network.http.referer.spoofSource The default value is false. Change it to true. This causes Firefox to instead submit the website being requested as the referrer; leaking no information, but breaking fewer sites.

Can someone explain why my browser provides referer info at all? Why isn't this a permission I need to give away? What common features that the user needs on the web rely on it?

DanBC 10y ago

The RFC suggested that permissions should be asked for. https://tools.ietf.org/html/rfc1945#section-10.13 https://tools.ietf.org/html/rfc1945#section-10.13 Note: Because the source of a link may be private information or may reveal an otherwise private information source, it is strongly recommended that the user be able to select whether or not the Referer field is sent. For example, a browser client could have a toggle switch for browsing openly/anonymously, which would respectively enable/disable the sending of Referer and From information.

nothrabannosir 10y ago
Not that it should be asked for; just that it should be configurable. Subtle but important difference. Firefox is following this recommendation, but doesn't ask for it explicitly.

detaro 10y ago

It's one of these things that were added once, pages started to rely on it and now nobody wants to turn it off globally because things will break. They've added ways for sites to control if/how much information is sent on outgoing links though in recent browsers. e.g. in HN's HTML you find <meta name="referrer" content="origin"> which tells the browser to only send the domain, but not the exact URL.

pierrec 10y ago

>What common features that the user needs on the web rely on it? - Website owners and content creators use the Referer to see where their users are coming from, which allows them to make content which is more suitable, which indirectly benefits the user. - It helps prevent hotlinking, so it can protect small websites from getting hammered, which again could indirectly benefit the user. I guess the point is that everyone's a "user" of HTTP, including website owners, and their interests are partly linked to yours. In an objective sense I find the standard still makes sense. In an individualistic sense, things are more complicated.

chestnut-tree 10y ago

If you are using Firefox, you can disable referrer info without using a plugin. Here‘s how: In the URL bar, type the following and press enter: about:config Now search for the following entry on the page: network.http.sendRefererHeader The default value is 2. Change this to 0. This disables the referrer header. Note that some sites won‘t allow you to sign in or register if the referrer header is disabled (e.g. Pinterest), so you may have to temporarily enable the referrer header in those instances. A final point is that this Firefox setting obviously has no effect if referral info is already appended to the URL (as is the case with Google search results).

userbinator 10y ago
There's also an intermediate value of 1, which AFAICS disables referer sending on requests for embedded images: http://kb.mozillazine.org/Network.http.sendRefererHeader http://kb.mozillazine.org/Network.http.sendRefererHeader
LukeShu 10y ago
Alternatively, you can instead set network.http.referer.spoofSource The default value is false. Change it to true. This causes Firefox to instead submit the website being requested as the referrer; leaking no information, but breaking fewer sites.